Tag Info

Hot answers tagged

13

These are academic distinctions. In the real world, you will find some combination of all of these concepts going by different terms. In some organizations, a DMZ has a separate ISP network connection and has no access to internal resources. In other organizations, there are domain-joined machines in the DMZ that can communicate to a restricted set of ...


8

Any network segment that you don't fully control can be considered as a public network, so if you would encrypt traffic over a regular public network, do it for your case as well. NB: With full control I mean that you have full and sole control over any network devices that are part of the connection, so a port on e.g. a router or switch you don't own ...


8

As @ChristopherPerrin said, it's the background noise of the internet. Scripts and bots are constantly scanning the internet, doing the equivalent of jiggling door handles looking for ones that are unlocked or poorly locked. I do however disagree that there is nothing you can do about it. Use those logs to block them at the firewall level. On linux I use ...


8

How would this be setup connection wise without forcing all traffic through the domain controller? With site to site VPNs. You'd set up your cloud assets as a site, and then establish a site-to-site VPN between your cloud site and each of your physical sites. An alternate option, that Microsoft uses, but is generally ill-advised (unless you really, ...


7

Depends on what you're comfortable doing; when starting to "professionalize" our office network for a similarly sized business, I set up a pfSense Firewall behind our modem, and assigned it routing tasks for the office. All you need is a machine to dedicate with a few NICs and you're on your way. It's pretty well documented online, and I haven't had an ...


7

I don't think I've recently heard of an extranet outside of textbooks and class rooms. A DMZ is a common networking topology with a network segment that is segregated by firewalls from the internal network and untrusted external networks (aka the internet). In contrast the Extranet, if it is actually included in the network design, implies somewhat that ...


6

OK, this question is asked over and over again over the Internet and most of the time there is a (semi-) incorrect answer that you cannot do what was described in the original post. Let me clarify it once and for all :) The short answer is L2TP (and PPTP for that matter) do not have facilities to do route pushes inside the protocol, but it can be achieved ...


5

According to Technet http://blogs.technet.com/b/stdqry/archive/2011/12/15/dns-clients-and-timeouts-part-2.aspx later queries are done to multiple DNS servers in parallel. And most people have only one network connection and a fast broadband connection and should normally expect a DNS response within 1s. So I have set my DNSQueryTimeouts to 1 1 1 10 10 0 so ...


5

CHAP requires that plaintext password be accessible to the authentication server. Active Directory doesn't store plaintext passwords by default, so CHAP won't work. It would appear that you can modify the VPN server configuration file (com.apple.RemoteAccessServers.plist) to use the MS-CHAPv2 authentication protocol. Given the weakness of the protocol I ...


5

I think it's actually more debated than you make it appear. There is an admittedly old, related Linux FAQ: http://www.tldp.org/HOWTO/VPN-HOWTO/ I've used a PPP-over-ssh-over-ADSL for more than 12 years, and it never failed me, so from my experience I'd dare to say that the doomsayers probably largely exaggerate. TCP over TCP is probably a bad idea with RTC ...


5

Reverse DNS points an IP to a domain name. An ISP/Hosting company should own the IP range, and it should be no problem at all for them to create a reverse DNS entry for your IP, unless it's not just your IP (you're on shared hosting). Should that be the case, you are not going to get anywhere. Your ISP/Hosting probably can get you your own individual IP, ...


4

Any thoughts? Don't do this. Either configure a client-based VPN connection for each host that you want to connect with, or configure a site-to-site VPN and bridge both sites in question. Windows 7 was not ever intended to be used the way that you're describing.


4

The Cisco AnyConnect client will not even install if you have Internet Connection Sharing (ICS) enabled. It's not supported at all. Get a firewall and set up a site-to-site VPN.


4

Keeping port 22 open is no less secure than keeping port 80 open on your web server as long as you are using public key authentication or secure user passwords. Many security practices are unfounded myths. It's unlikely that severe exploits exist in sshd. Why is the VPN server's port suddenly more secure than the SSH port? Just verify your SSH public key ...


4

IPsec in transport mode would do this, but this really isn't scalable. Four nodes is about the most at which I would even think about it. I'm currently using strongSwan for IPsec on Linux, which is easy enough to set up this way. Since you edited your question and changed the requirements a bit, I'm going to recommend you take a look at Open vSwitch ...


4

What you don't want is a VPN. What you do want is indeed IPsec, but not in tunnel mode. Rather, you want IPsec in transport mode. In this configuration, each host communicates directly to its peer, and only packet payloads are encrypted, leaving IP headers in place. This way, you don't need to do any routing gymnastics to get things working. Yes, you'll ...


4

Setting up a VPN can be pretty easy, many routers have some built-in VPN functionality already. VPN is a broad topic and we don't know what your needs and constraints are, because you didn't tell us. You should probably hire a consultant to help you get it set up and find out what your needs and constraints are; this shouldn't be a service that you pay for ...


4

Network browsing across VPNs has always been problematic in my experience. If I were you I'd use a WINS server to get browsing to work (in an even remotely reliable manner). Other methods may well work, but deploying WINS is pretty straightforward and easy and, in my experience, has done the job.


4

With a Cisco AnyConnect VPN there is an option on the client side to allow this IF the VPN admin is allowing split-tunneling. You can see the option here: As far as on the firewall itself, if you are the VPN/firewall admin (I'm guessing you aren't) then the setting is similar to this here:


3

Despite being an old question I stumbled here and I can see a lot of speculation here. The other answers are likely correct to some extent, but I believe it misses the crucial factor for the situation experienced by the asker. VPN uses compression. I'm using LZO-compression and that will improve my speeds up to 4x compared to the connection width. This is ...


3

Adding GRE to Amazon Security Group is very easy but somewhat hidden. In your case, to allow PPTP VPN inbound connection to EC2 instance, create a rule in Security Group as follows: Select "Custom protocol rule" in the "Create a new rule" drop-down menu. Enter "47" in the "Protocol" field. Enter CIDR (IP range) for the clients subnets (for testing only, ...


3

I use netcat, you can download the windows version here On one end of the VPN start a listener (-l for listen -u for UDP): nc -lu <port> On the other end test the UDP connection, text entered after issuing the nc command should appear on the listener terminal: nc -u <litenerIP> <port> here's a local test run in 2 separate terminals: ...


3

Windows supports SSTP, L2TP, and PPTP, as well as DirectAccess (with Enterprise SKUs). No OpenVPN support here, you need to use the OpenVPN client for that.


3

You could use OpenVPN. If you use a OpenVPN server listening on port 443, it will probably not be filtered. However, people analyzing your network traffic will know that you are using OpenvPN: you might want to avoid this. If you want to avoid this, you could connect to the OpenVPN server through a HTTPS proxy. OpenVPN knows how to use a HTTP proxy but not ...


3

It sounds like the printer isn't configured with a default gateway. In that scenario your ping requests from "Network A" will travel to "Network B" to the printer. The printer, having no default gateway configured, won't be able to respond back to "Network B" because, without a default gateway configured, it has no ability to send packets to subnets other ...


3

What about putting it in bridged mode, and using your own router to see if the problem still happens. My guess some kind of problem in the routing side of things, persistent NAT? Anyway, just about no one that I know uses carrier provided gear, mainly for security and manageability concerns. Even if you get something else, you should consider something ...


3

In the SSLVPN adapter, in TCP/IP properties, DNS, make sure Register this connection's addresses in DNS actually checked. Often on a VPN connection it isn't...


3

Your clients are not registering their IP addresses with DNS for the simple reason that they're not configure to, when connecting to the VPN. This behavior is called Dynamic DNS Registration, and in Windows, is a per-network adapter setting. Through the GUI, you'd enable or disable this on the network adapter Properties, the Networking tab, TCP/IP ...


3

10.8.2.12 sees 10.8.2.254 as being on the same subnet, therefore it's requesting the MAC address of 10.8.2.254 to insert it as a dest MAC in future packets to 10.8.2.254. Since 10.8.2.254 doesn't exist, no one is replying and 10.8.2.12 never finds out what MAC to set as the dest MAC. Try using proxy_arp on your main server. echo 1 > ...


3

I think using a cloud service (Box, others) makes a lot of sense for your requirements, especially "minimal maintenance," , and "multiple locations." $15/user/month for Box, with some nice (AD integration, version history, central admin) features.



Only top voted, non community-wiki answers of a minimum length are eligible